# NousResearch/hermes-agent · Plaintext secrets in .env files security concern

## Open now

- Nothing open on GitHub.

A reported security issue identifies that profile .env files expose plaintext secrets including LITELLM_MASTER_KEY and others. A related feature request proposes adopting Varlock to mitigate the risk of .env secret exfiltration.

## TL;DR

- 2 member(s): 0 open issue(s), 2 closed issue(s), 0 open PR(s), 0 merged PR(s), 0 PR(s) closed without merging.
- No fix found: no merged or attempted fix PR is on record for this cluster.
- **Recommended:** if this matches your symptom, consider adding to the existing issue(s) below rather than opening a new one.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`LLM_ONLY`): no structural link between members; the grouping rests entirely on an automated relevance judgement over their text.
- Read the members yourself before treating them as one problem.
- Pairwise link density `0.36`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #1583: \[Feature\]: Mitigate plaintext secret (.env) exfiltration risk by adopting Varlock
- #45159: CRITICAL: Profile .env files contain plaintext secrets (LITELLM_MASTER_KEY + 18 others)

## Fix status

- No merged fix on record.
- Subsystem: `agent`